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Abstract 


During the transition from IPv4 to IPv6, 


customer equipment may have 


to support one of the various transition methods that have been 


defined for carrying IPv4 packets over IPv6. 


This document 


enumerates the information that needs to be provisioned on a customer 
edge router to support a list of transition techniques based on 


tunneling IPv4 in IPv6, 


for a reasonable transition path between these techniques. 
extent that the provisioning is done dynamically, 
and Accounting 


Authorization, 


with a view to defining reusable components 


To the 
Authentication, 


(AAA) support is needed to provide the 


information to the network server responsible for passing the 


information to the customer equipment. 
Attribute-Value Pairs 
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1. Introduction 


A number of transition techniques have been defined to allow IPv4 
packets to pass between hosts and IPv4 networks over an intervening 
IPv6 network while minimizing the number of public IPv4 addresses 
that need to be consumed by the hosts. Different operators will 
deploy different technologies, and sometimes one operator will use 
more than one technology depending on what is supported by the 
available equipment and upon other factors both technical and 
economic. 


Each technique requires the provisioning of some subscriber-specific 
information on the customer edge device. The provisioning may be by 
DHCPv6 [RFC3315] or by some other method. This document is 
indifferent to the specific provisioning technique used but assumes a 
deployment in which that information is managed by AAA 
(Authentication, Authorization, and Accounting) servers. It further 
assumes that this information is delivered to intermediate network 
nodes for onward provisioning using the Diameter protocol [RFC6733]. 


As described below, in the particular case where the Lightweight 
4over6 (lw406) [RFC7596] transition method has been deployed, per- 
subscriber-site information almost identical to that passed to the 
subscriber site [RFC7598] also needs to be delivered to the border 
router serving that site. The Diameter protocol may be used for this 
purpose too. 


This document analyzes the information required to configure the 
customer edge equipment for the following set of transition methods: 


o Dual-Stack Lite (DS-Lite) [RFC6333], 
o Lightweight 4over6 (1w406) [RFC7596], and 
o Mapping of Address and Port with Encapsulation (MAP-E) [RFC7597]. 


[DSLITE-MULTICAST] specifies a generic solution for delivery of IPv4 
multicast services to IPv4 clients over an IPv6 multicast network. 
The solution was developed with DS-Lite in mind but it is not limited 
to DS-Lite. As such, it applies also for lw4o6 and MAP-E. This 
document analyzes the information required to configure the customer 
edge equipment for the support of multicast in the context of DS- 
Lite, MAP-E, and lw406 in particular. 


On the basis of those analyses, it specifies a number of Attribute- 


Value Pairs (AVPs) to allow the necessary subscriber-site-specific 
configuration information to be carried in Diameter. 
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This document doesn’t specify any new commands or Application IDs. 
The specified AVPs could be used for any Diameter application 
suitable for provisioning. 


1.1. Requirements Language 


The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 
document are to be interpreted as described in [RFC2119]. 


The abbreviation CPE stands for Customer Premise Equipment. It 
denotes the equipment at the customer edge that terminates the 
customer end of an IPv6 transitional tunnel. This will usually be a 
router but could be a host directly connected to the network. In 
some documents (e.g., [RFC7597]), this functional entity is called CE 
(Customer Edge). 


The term "tunnel source address" is used to denote the IPv6 source 
address used in the outer header of packets sent from the CPE through 
an lw406 transitional tunnel to the border router. 


2. Description of the Parameters Required by Each Transition Method 


This section reviews the parameters that need to be provisioned for 
each of the transition methods listed above. This enumeration 
provides the justification for the AVPs defined in the next section. 


A means is required to indicate which transition method(s) a given 
subscriber wants to use. The approach taken in this document is to 
specify Grouped AVPs specific to lw406 and MAP-E. The operator can 
control which of these two transition methods a given subscriber uses 
by ensuring that AAA passes only the Grouped AVP relevant to that 
method. A Grouped AVP is unnecessary for DS-Lite since AAA has only 
to provide the Fully Qualified Domain Name (FQDN) of the DS-Lite 
Address Family Transition Router (AFTR) (see Section 2.1). Hence, 
when no Grouped AVP is provided either for lw406 or MAP-E and only 
the AFTR’s FODN is present, this indicates that the subscriber 
equipment will use the DS-Lite transition method. Provisioning of 
multicast is an orthogonal activity since it is independent of the 
transition method. 
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2s 


2 


1. Parameters for Dual-Stack Lite (DS-Lite) 


DS-Lite is documented in [RFC6333]. The Basic Bridging BroadBand 
(B4) element at the customer premises needs to discover the IPv6 
address of the AFTR (border router). For the reasons discussed in 


Section 3.2, the AAA server provisions the B4 element with the AFTR's 
FODN that is passed to a B4’s IP resolution library. The AFTR's FODN 
is contained in the Border-Router-Name AVP (see Section 3.2). 


The B4 element could also be configured with the IPv4 address of the 
B4 interface facing the tunnel, with valid values from 192.0.0.2 to 
192.0.0.7 and the default value of 192.0.0.2 in the absence of 
provisioning.  Provisioning such information through AAA is 
problematic because it is most likely used in a case where multiple 
B4 instances occupy the same device. This document therefore assumes 
that the B4 interface address is determined by other means than AAA 
(implementation dependent or static assignment). 


.2. Lightweight 4over6 (1w406) 


Lightweight 4over6 (1w406) is documented in [RFC7596].  Lw4o6 
requires four items to be provisioned to the customer equipment: 


o an IPv6 address of the border router. 
o an IPv6 prefix used by the CPE to construct the tunnel source 


address. In the terminology of [RFC7596], this is the IPv6 
Binding Prefix. 


o an IPv4 address to be used on the external side of the CPE. 


o if the IPv4 address is shared, a specification of the port set the 
subscriber site is allowed to use. Please see the description in 
Section 2.3. For lw406, all three of the parameters 'a', 'k', and 
the Port Set Identifier (PSID) described in that section are 
required. The default value of the offset parameter 'a' is 0. 


As discussed in Section 4 of [RFC7596], it is necessary to 
synchronize this configuration with corresponding per-subscriber 
configuration at the border router. The border router information 
consists of the same public IPv4 address and port set parameters that 
are passed to the CPE, bound together with the full /128 IPv6 address 
(not just the Binding Prefix) configured as the tunnel source address 
at the CPE. 
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2.3. Port Set Specification 


When an external IPv4 address is shared, lw406 and MAP-E restrict the 
CPE to use of a subset of all available ports on the external side. 
Both transition methods use the algorithm defined in Appendix B of 
[RFC7597] to derive the values of the port numbers in the port set. 
This algorithm features three parameters, describing the positioning 
and value of the PSID within each port number of the generated set: 


o an offset ’a’ from the beginning of the port number to the first 
bit of the PSID; 


o the length 'k' of the PSID within the port number, in bits; and 
o the value of the PSID itself. 
2.4. Mapping of Address and Port with Encapsulation (MAP-E) 


Mapping of Address and Port with Encapsulation (MAP-E) is described 
in [RFC7597]. MAP-E requires the provisioning of the following per- 
subscriber information at the customer edge device: 


o the IPv6 address of one or more border routers, or in MAP-E 
terminology, MAP-E border relays. 


o the unique end-user IPv6 prefix for the customer edge device. 
This may be provided by AAA or acquired by other means. 


o the Basic Mapping Rule for the customer edge device. This 
includes the following parameters: 


* the Rule IPv6 prefix and length. 


* the Rule IPv4 prefix and length. A prefix length of 0 
indicates that the entire IPv4 address or prefix is coded in 
the Extended Address (EA) bits of the end-user IPv6 prefix 
rather than in the mapping rule. 


* the number of EA bits included in the end-user IPv6 prefix. 


* port set parameters giving the set of ports the CPE is allowed 
to use when the IPv4 address is shared. Please see the 
description of these parameters in Section 2.3. At a minimum, 
the offset parameter 'a' is required. For MAP-E, this has the 
default value 6. The parameters 'k' and PSID are needed if 
they cannot be derived from the mapping rule information and 
the EA bits (final case of Section 5.2 of [RFC7597]). 
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o whether the device is to operate in Mesh or Hub-and-Spoke mode. 


o in mesh mode only, zero or more Forwarding Mapping Rules described 
by the same set of parameters as the Basic Mapping Rule. 


As indicated in the first bullet in Section 5 of [RFC7597], a MAP CPE 
can be provisioned with multiple end-user IPv6 prefixes, each 
associated with its own Basic Mapping Rule. This does not change the 
basic requirement for representation of the corresponding information 
in the form of Diameter AVPs, but adds a potential requirement for 
multiple instances of this information to be present in the Diameter 
message, differing in the value of the end-user IPv6 prefix (in 
contrast to the Forward Mapping Rule instances). 


The border router needs to be configured with the superset of the 
Mapping Rules passed to the customer sites it serves. Since this 
requirement does not require direct coordination with CPE 
configuration in the way lw4o6 does, it is out of scope of the 
present document. However, the AVPs defined here may be useful if a 
Separate Diameter application is used to configure the border router. 


2.5. Parameters for Multicast 


[DSLITE-MULTICAST] specifies a generic solution for delivery of IPv4 
multicast services to IPv4 clients over an IPv6 multicast network. 
In particular, the solution can be deployed in a DS-Lite context but 
is also adaptable to lw406 and MAP-E. For example, [PREFIX-OPTION] 
specifies how DHCPv6 [RFC3315] can be used to provision multicast- 
related information. The following lists the multicast-related 
information that needs to be provisioned: 


o ASM-mPrefix64: the IPv6 multicast prefix to be used to synthesize 
the IPv4-embedded IPv6 addresses of the multicast groups in the 
Any-Source Multicast (ASM) mode. This is achieved by 
concatenating the ASM-mPrefix64 and an IPv4 multicast address; the 
IPv4 multicast address is inserted in the last 32 bits of the 
IPv4-embedded IPv6 multicast address. 


o SSM-mPrefix64: the IPv6 multicast prefix to be used to synthesize 
the IPv4-embedded IPv6 addresses of the multicast groups in the 
Source-Specific Multicast (SSM) [RFC4607] mode. This is achieved 
by concatenating the SSM-mPrefix64 and an IPv4 multicast address; 
the IPv4 multicast address is inserted in the last 32 bits of the 
IPv4-embedded IPv6 multicast address. 
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o uPrefix64: the IPv6 unicast prefix to be used in SSM mode for 
constructing the IPv4-embedded IPv6 addresses representing the 
IPv4 multicast sources in the IPv6 domain. uPrefix64 may also be 
used to extract the IPv4 address from the received multicast data 
flows. The address mapping follows the guidelines documented in 
[RFC6052]. 


2.6. Summary and Discussion 


There are two items that are common to the different transition 
methods, and the corresponding AVPs to carry them can be reused: 


o a representation of the IPv6 address of a border router. 


O a set of prefixes for delivery of multicast services to IPv4 
clients over an IPv6 multicast network. 


[RFC6519] sets a precedent for representation of the IPv6 address of 
a border router as an FQDN. This can be dereferenced to one or more 
IP addresses by the provisioning system before being passed to the 
customer equipment or left as an FQDN as it is in [RFC6334]. 


The remaining requirements are transition-method specific: 

o for lw4o6, a representation of a binding between (1) either the 
IPv6 Binding Prefix or a full /128 IPv6 address, (2) a public IPv4 
address, and (3) (if the IPv4 address is shared) a port set 


identifier. 


o for MAP-E, a representation of the unique end-user IPv6 prefix for 
the CPE, if not provided by other means. 


o for MAP-E, a representation of a Mapping Rule. 


o for MAP-E, an indication of whether Mesh mode or Hub-and-Spoke 
mode is to be used. 


3. Attribute-Value Pair Definitions 


This section provides the specifications for the AVPs needed to meet 
the requirements summarized in Section 2.6. 
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3.1.  IP-Prefix-Length AVP 


The IP-Prefix-Length AVP (AVP code 632) is of type Unsigned32. It 
provides the length of an IPv4 or IPv6 prefix. Valid values are from 
0 to 32 for IPv4 and from 0 to 128 for IPv6. Tighter limits are 
given below for particular contexts of use of this AVP. 


Note that the IP-Prefix-Length AVP is only relevant when associated 
with an IP-Address AVP in a Grouped AVP. 


3.2.  Border-Router-Name AVP 


Following on the precedent set by [RFC6334] and [RFC6519], this 
document identifies a border router using an FODN rather than an 
address. The Border-Router-Name AVP (AVP Code 633) is of type 
OctetString. The FODN encoding MUST follow the Name Syntax defined 
in [RFC1035], [RFC1123], and [RFC2181] and are represented in ASCII 
form. Note, if Internationalized Domain Names (IDNs) are used, 
A-labels defined in [RFC5891] must be used (see Appendix D of 
[RFC6733]). 


3.3. 64-Multicast-Attributes AVP 


The 64-Multicast-Attributes AVP (AVP Code 634) is of type Grouped. 

It contains the multicast-related IPv6 prefixes needed for providing 
IPv4 multicast over IPv6 using DS-Lite, MAP-E, or lw4o6, as mentioned 
in Section 2.5. 


The syntax is shown in Figure 1. 
AVP Header: 634 » 


ASM-mPrefix64 ] 


64-Multicast-Attributes ::= < 
[ 
[ SSM-mPrefix64 ] 
[ 
[ 


Delegated-IPv6-Prefix ] 
AVP ] 
Figure 1: 64-Multicast-Attributes AVP 


The 64-Multicast-Attributes AVP MUST include the ASM-mPrefix64 AVP or 
the SSM-mPrefix64 AVP, and it MAY include both. 


The Delegated-IPv6-Prefix AVP MUST be present when the SSM-mPrefix64 


AVP is present. The Delegated-IPv6-Prefix AVP MAY be present when 
the ASM-mPrefix64 AVP is present. 
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3.3.1. ASM-mPrefix64 AVP 
The ASM-mPrefix64 AVP 


type Grouped, 


ASM-mPrefix64 < 
{ 
{ 
el 


Figure 2: 


AVPs for 4over6 CPE Provisioning 


(AVP Code 635) 
mPrefix64 as mentioned in Section 2.5. 
as shown in Figure 2. 


is defined in [RFC5777] 


October 2015 


conveys the value of ASM- 
The ASM-mPrefix64 AVP is of 


AVP Header: 635 > 
IP-Address ) 
IP-Prefix-Length } 


AVP ] 
ASM-mPrefix64 AVP 


and is of type 
it provides the value of an 


The AddressType field in IP-Address MUST have value 2 


IP-Address (AVP code 518) 

Address. Within the ASM-mPrefix64 AVP, 
IPv6 prefix. 

(IPv6). 

range. 


The conveyed multicast IPv6 prefix MUST belong to the ASM 
Unused bits in IP-Address beyond the actual prefix MUST be 


set to zeroes by the sender and ignored by the receiver. 


The IP-Prefix-Length AVP 
AVP, 
3.3.2. SSM-mPrefix64 AVP 
The SSM-mPrefix64 AVP 


type Grouped, 


(AVP code 632) 
the prefix contained in the IP-Address AVP. 
valid values of the IP-Prefix-Length AVP are from 24 to 96. 


(AVP Code 636) 
mPrefix64 as mentioned in Section 2.5. 
as shown in Figure 3. 


provides the actual length of 
Within the ASM-mPrefix64 


conveys the value of SSM- 
The SSM-mPrefix64 AVP is of 


SSM-mPrefix64 = < AVP Header: 636 > 
{ IP-Address } 
{ IP-Prefix-Length } 
*[ AVP ] 
Figure 3: SSM-mPrefix64 AVP 
IP-Address (AVP code 518) provides the value of an IPv6 prefix. The 
AddressType field in IP-Address MUST have value 2 (IPv6). The 
Unused 


conveyed multicast IPv6 prefix MUST belong to the SSM range. 


bits in IP-Address beyond the actual prefix MUST be set to zeroes by 
the sender and ignored by the receiver. 


The IP-Prefix-Length AVP 


(AVP code 632) 


provides the actual length of 


the prefix contained in the IP-Address AVP. 
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3.3.3. Delegated-IPv6-Prefix AVP as uPrefix64 


Within the 64-Multicast-Attributes AVP, the Delegated-IPv6-Prefix AVP 
(AVP Code 123) conveys the value of uPrefix64, a unicast IPv6 prefix, 
as mentioned in Section 2.5. The Delegated-IPv6-Prefix AVP is 
defined in [RFC4818]. As specified by [RFC6052], the value in the 
Prefix-Length field MUST be one of 32, 48, 56, 64, or 96. 


3.4.  Tunnel-Source-Pref-Or-Addr AVP 


The Tunnel-Source-Pref-Or-Addr AVP (AVP Code 637) conveys either the 
IPv6 Binding Prefix or the tunnel source address on the CPE, as 
described in Section 2.2. The Tunnel-Source-Pref-Or-Addr AVP is of 
type Grouped with syntax as shown in Figure 4. The Tunnel-Source- 
Pref-Or-Addr AVP MUST contain either the Delegated-IPv6-Prefix AVP or 
the Tunnel-Source-IPv6-Address AVP, not both. 
Tunnel-Source-Pref-Or-Addr ::= « AVP Header: 637 > 

[ Delegated-IPv6-Prefix ] 

[ Tunnel-Source-IPv6-Address ] 
*[ AVP ] 


Figure 4: Tunnel-Source-Pref-Or-Addr AVP 


This AVP is defined separately from the lw406-Binding AVP (which 
includes it) to provide flexibility in the transport of the tunnel 
Source address from the provisioning system to AAA while also 


supporting the provision of a complete binding to the lw4o6 border 
router. 


3.4.1.  Delegated-IPv6-Prefix as the IPv6 Binding Prefix 


The Delegated-IPv6-Prefix AVP (AVP code 123) is of type OctetString 
and is defined in [RFC4818]. Within the Tunnel-Source-Pref-Or-Addr 
AVP, it conveys the IPv6 Binding Prefix assigned to the CPE. Valid 
values in the Prefix-Length field are from 0 to 128 (full address). 


3.4.2.  Tunnel-Source-IPv6-Address AVP 
The Tunnel-Source-IPv6-Address AVP (AVP code 638) is of type Address. 
It provides the address assigned by the CPE to identify its local end 


of an lw406 tunnel. The AddressType field in this AVP MUST be set to 
2 (IPv6). 
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Port-Set-Identifier 


The Port-Set-Identifier AVP (AVP Code 639) is a structured 
OctetString with four octets of data, hence a total AVP length of 12. 
The description of the structure that follows refers to the 
parameters described in Section 2.3 (see Figure 5). 


o The first (high-order) octet is the Offset field. It is 
interpreted as an 8-bit unsigned integer giving the offset 'a' 
from the beginning of a port number to the beginning of the PSID 
to which that port belongs. Valid values are from 0 to 15. 


o The next octet, the PSIDLength, is also interpreted as an 8-bit 
unsigned integer and gives the length ’k’ in bits of the PSID. 
Valid values are from 0 to (16 - a). A value of 0 indicates that 
the PSID is not present (probable case for MAP-E, see 
Section 2.4), and the PSIDValue field MUST be ignored. 


o The final two octets contain the PSIDValue field. They give the 
value of the PSID itself, right justified within the field. That 
is, the value of the PSID occupies the 'k' lowest-order bits of 
the PSIDValue field. 


0 1 2 3 

012345678901234567890123456789012 
+ hh RO A RO dd de e e de de dd dd de 4 4 4 4 + + + +++ ++ +++ 
| Offset | Length | PSID Value | 
$ hh RO A dd de e e e de dd dd de de 4 4 4 4 + + + ++ +++ +++ 


Figure 5: Port Set 
Lw406-Binding AVP 


The Lw4o6-Binding AVP (AVP Code 640) is of type Grouped. It contains 
the elements of configuration that constitute the binding between an 
lw406 tunnel and IPv4 packets sent through that tunnel, as described 
in Section 2.2. 


AVP Header: 640 > 


Tunnel-Source-Pref-Or-Addr } 


Lw4o6-Binding ::= < 
{ 
{ Lw4o6-External-IPv4-Addr ) 
[ 
[ 


Port-Set-Identifier ] 
AVP ] 


Figure 6: Lw406-Binding AVP 


u, et al. Standards Track [Page 13] 


REC 7678 AVPs for 4over6 CPE Provisioning October 2015 


The Tunnel-Source-Pref-Or-Addr AVP is defined in Section 3.4 and 
provides either the Binding Prefix or the full IPv6 tunnel source 
address. 


The Lw4o6-External-IPv4-Addr AVP is defined in Section 3.6.1. 


The Port-Set-Identifier AVP is defined in Section 3.5. It identifies 
the specific set of ports assigned to the lw406 tunnel when the IPv4 
address is being shared. 


3.6.1.  Lw4o6-External-IPv4-Addr AVP 


The Lw4o6-External-IPv4-Addr AVP (AVP Code 641) uses the Address 
derived data format defined in Section 4.3.1 of [RFC6733]. It 
provides the CPE's external IPv4 address within the lw406 tunnel 
associated with the given binding. The AddressType field MUST be set 
to 1 (IPv4), and the total length of the AVP MUST be 14 octets. 


3.7. MAP-E-Attributes 


The MAP-E-Attributes AVP (AVP Code 642) is of type Grouped. It 
contains the configuration data identified in Section 2.4 for all of 
the mapping rules (Basic and Forwarding) in a single MAP domain. 
Multiple instances of this AVP will be present if the CPE belongs to 
multiple MAP domains. 


MAP-E-Attributes ::= « AVP Header: 642 > 
1*{ Border-Router-Name } 
1*{ MAP-Mapping-Rule } 
[ MAP-Mesh-Mode ] 
[ Delegated-IPv6-Prefix ] 
*[ AVP ] 


Figure 7: MAP-E-Attributes AVP 


The Border-Router-Name AVP is defined in Section 3.2. It provides 
the FODN of a MAP border relay at the edge of the MAP domain to which 
the containing MAP-E-Attributes AVP relates. At least one instance 
of this AVP MUST be present. 


The MAP-Mapping-Rule AVP is defined in Section 3.9. At least one 
instance of this AVP MUST be present. If the MAP-E domain supports 
Mesh mode (indicated by the presence of the MAP-Mesh-Mode AVP), 
additional MAP-Mapping-Rule instances MAY be present. If the MAP-E 
domain is operating in Hub-and-Spoke mode; additional MAP-Mapping- 
Rule instances MUST NOT be present. 
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The MAP-Mesh-Mode AVP is defined in Section 3.8. The absence of the 
Mesh mode indicator attribute indicates that the CPE is required to 
operate in Hub-and-Spoke mode. 


The Delegated-IPv6-Prefix AVP (AVP Code 123) provides the end-user 
IPv6 prefix assigned to the CPE for the MAP domain to which the 
containing MAP-E-Attributes AVP relates. The AVP is defined in 
[RFC4818]. Valid values of the Prefix-Length field range from 0 to 
128. 


The Delegated-IPv6-Prefix AVP is optional because, depending on 
deployment, the end-user IPv6 prefix may be provided by AAA or by 
other means. If multiple instances of the MAP-E-Attributes AVP 
containing the Delegated-IPv6-Prefix AVP are present, each instance 
of the latter MUST have a different value. 


3.8. MAP-Mesh-Mode 
The MAP-Mesh-Mode AVP (AVP Code 643) is of type Enumerated and 
indicates whether the CPE has to operate in Mesh or Hub-and-Spoke 
mode when using MAP-E. The following values are supported: 
O MESH 


1 HUB_AND_SPOKE 


The absence of the Mesh mode indicator attribute indicates that the 
CPE is required to operate in Hub-and-Spoke mode. 


3.9.  MAP-Mapping-Rule 


The MAP-Mapping-Rule AVP (AVP Code 644) is of type Grouped and is 
used only in conjunction with MAP-based transition methods. Mapping 
rules are required both by the MAP border relay and by the CPE. The 
components of the MAP-Mapping-Rule AVP provide the contents of a 
mapping rule as described in Section 2.4. 


The syntax of the MAP-Mapping-Rule AVP is as follows: 


AVP Header: 644 > 
Rule-IPv4-Addr-Or-Prefix ) 


MAP-Mapping-Rule  ::- 


« 

{ 

{ Rule-IPv6-Prefix } 
{ EA-Field-Length } 
{ Port-Set-Identifier } 
*[ AVP ] 


Figure 8: MAP-Mapping-Rule AVP 
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The Rule-IPv4-Addr-Or-Prefix, Rule-IPv6-Prefix, EA-Field-Length, and 
Port-Set-Identifier AVPs MUST all be present. 


The Port-Set-Identifier AVP provides information to identify the 
Specific set of ports assigned to the CPE. For more information, see 
Sections 2.4 and 2.3. The Port-Set-Identifier AVP is defined in 
Section 3.5. 


3.9.1. Rule-IPv4-Addr-Or-Prefix AVP 


The Rule-IPv4-Addr-Or-Prefix AVP (AVP Code 645) conveys the Rule IPv4 
prefix and length as described in Section 2.4. The Rule-IPv4-Addr- 
Or-Prefix AVP is of type Grouped, as shown in Figure 9. 
Rule-IPv4-Addr-Or-Prefix ::= < AVP Header: 645 > 
{ IP-Address } 
{ IP-Prefix-Length } 
*[ AVP ] 


Figure 9: Rule-IPv4-Addr-Or-Prefix AVP 


IP-Address (AVP code 518) is defined in [RFC5777] and is of type 
Address. Within the Rule-IPv4-Addr-Or-Prefix AVP, it provides the 
value of a unicast IPv4 address or prefix. The AddressType field in 
IP-Address MUST have value 1 (IPv4). Unused bits in IP-Address 
beyond the actual prefix MUST be set to zeroes by the sender and 
ignored by the receiver. 


The IP-Prefix-Length AVP (AVP code 632) provides the actual length of 
the prefix contained in the IP-Address AVP. Within the Rule-IPv4- 
Addr-Or-Prefix AVP, valid values of the IP-Prefix-Length AVP are from 
O to 32 (full address) based on the different cases identified in 
Section 5.2 of [RFC7597]. 


3.9.2. Rule-IPv6-Prefix AVP 


The Rule-IPv6-Prefix AVP (AVP Code 646) conveys the Rule IPv6 prefix 
and length as described in Section 2.4. The Rule-IPv6-Prefix AVP is 
of type Grouped, as shown in Figure 10. 
Rule-IPv6-Prefix ::= < AVP Header: 646 > 
{ IP-Address } 
{ IP-Prefix-Length } 
*[ AVP ] 


Figure 10: Rule-IPv6-Prefix AVP 
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3; 


9 


IP-Address (AVP code 518) is defined in [RFC5777] and is of type 
Address. Within the Rule-IPv6-Prefix AVP, it provides the value of a 
unicast IPv6 prefix. The AddressType field in IP-Address MUST have 
value 2 (IPv6). Unused bits in IP-Address beyond the actual prefix 
MUST be set to zeroes by the sender and ignored by the receiver. 


The IP-Prefix-Length AVP (AVP code 632) provides the actual length of 
the prefix contained in the IP-Address AVP. Within the Rule- 
IPv6-Prefix AVP, the minimum valid prefix length is 0. The maximum 
value is bounded by the length of the end-user IPv6 prefix associated 
with the mapping rule, if present in the form of the Delegated- 
IPv6-Prefix AVP in the enclosing MAP-E-Attributes AVP. Otherwise, 
the maximum value is 128. 


3. EA-Field-Length AVP 


The EA-Field-Length AVP (AVP Code 647) is of type Unsigned32. Valid 
values range from 0 to 48. See Section 5.2 of [RFC7597] fora 
description of the use of this parameter in deriving IPv4 address and 
port number configuration. 
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Zhou, et al. 


Attribute-Value Pair Flag Rules 


Attribute Name 


+ E A i rale d e A A ta Rr y a A A a Ri iT uer A ii A a AA st A vr A de 


| IP-Prefix-Length 


+ ——— E O —— AS M AA AS AA SS SS a 


|Border-Router-Name 


+ AAA A AA AAA A A A A AAA —— A A See A AAA eg oe ee 


|64-Multicast-Attributes 


+ Se SS — Se SS AAA SS SS Se eS Se A A eS A AS A A ee 


| ASM-mP refix64 


+ Sa he pi ai Pat a RE SR cl ea pe a e el A cs e Sa a RO ME LR med 


| SSM-mPrefix64 


+ PI ———————————-——Ó————————À—————— — ca tl es st 


| Tunnel-Source-Pref-Or-Addr 


+ A AN A A IN AE qr pe enn A A E pm (es eins lS AN A e ee gt) 


| Tunnel-Source-IPv6-Address 


+ HH ————Á————————————Á—————— ———— ————— —M———— 


|Port-Set-Identifier 


+ —————————————Á— ——— — SSO A AA A Se Se A o e 


| Lw406-Binding 


+ A AAA AA A A A A A A A A — A A —— 


| Lw406-External-IPv4-Addr 


+ SoS A A A SS uL E ui SS A A Se A eS SS m gt a 


|MAP-E-Attributes 


+ E a E viaa a a ee a ee 


| MAP-Mesh-Mode 


+ SoS SoS p SSS eS p. Ens SS e CS ee eS A ee e ee ee p Cms qu. ee 


| MAP-Mapping-Rule 


+ A A AA A A A A AAA AA A A AA A A AA ec A A pi 


|Rule-IPv4-Addr-Or-Prefix 


+ SS A AS A A A SS SS SS SSA A Se eS  —— AS ee 


|Rule-IPv6-Prefix 


+ ———— ae A A  ————M —— A A A ee ea Sr a A tae ee ce  ——— 


|EA-Field-Length 


+ PEA E A A a a A E AS ANS E 


AVP 
Code 


As described in the Diameter base protocol 
for a given AVP in a given command may be defined by the application. 


Standards Track 
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October 2015 


4--------- * 

|AVP flag | 

| rules | 

+----+----+ 

Section | [MUST | 
Defined Value Type | MUST | NOT | 
4---—R---- 

3.3 Unsigned32 | |v | 
+----+----+ 

3.2 OctetString | |v | 
+----+----+ 

3.3 Grouped | |v | 
+----+----+ 

3.3.1 Grouped | |v | 
+----+----+ 

3.3.2 Grouped | E AE 
+----+----+ 

3.4 Grouped | | v | 
+----+----+ 

3.4.2 Address | [ie] 
+----+----+ 

25 OctetString | | v | 
+----+----+ 

3.6 Grouped | jie 1 
+----+----+ 

3.6.1 Address | |v | 
+----+----+ 

3.7 Grouped | Iv |] 
+----+----+ 

3.8 Enumerated | |v | 
+----+----+ 

3.9 Grouped | | v | 
+----+----+ 

3.9.1 Grouped | [ise] 
+----+----+ 

3.9.2 Grouped | |v | 
+----+----+ 

3.9.3 Unsigned32 | |v | 
+----+----+ 

[RFC6733], the M-bit usage 
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5. IANA Considerations 


IANA has registered the following Diameter AVP codes in the "AVP 
Codes" registry: 


+------ P N 5-5-5 T EE $2 + 

| Code | Attribute Name | Reference 

+= AZ A $ + 
632 IP-Prefix-Length This document 
633 Border-Router-Name This document 

| 634 | 64-Multicast-Attributes | This document | 

| 635 | ASM-mPrefix64 | This document | 

| 636 | SSM-mPrefix64 | This document | 

| 637 | Tunnel-Source-Pref-Or-Addr | This document | 

| 638 | Tunnel-Source-IPv6-Address | This document | 
639 Port-Set-Identifier | This document | 

| 640 | Lw4o6-Binding This document 

| 641 | Lw4o6-External-IPv4-Addr | This document | 

| 642 | MAP-E-Attributes | This document | 

| 643 | MAP-Mesh-Mode | This document | 

| 644 | MAP-Mapping-Rule | This document | 
645 Rule-IPv4-Addr-Or-Prefix This document | 

| 646 | Rule-IPv6-Prefix | This document 

| 647 | EA-Field-Length | This document | 

+= A == 4+--------------- + 

Table 1: Diameter AVP Codes 
6. Security Considerations 


6.1. Man-In-The-Middle (MITM) Attacks 


The AVPs defined in this document face two threats, both dependent on 
man-in-the-middle (MITM) attacks on the Diameter delivery path. 


The first threat is denial-of-service (DoS) through modification of 
the AVP contents leading to misconfiguration; e.g., a subscriber may 
fail to access its connectivity service if an invalid IP address was 
configured, the subscriber’s traffic can be intercepted by a 
misbehaving node if a fake Border Node has been configured, etc. 


The second threat is that Diameter security is currently provided on 
a hop-by-hop basis (see Section 2.2 of [RFC6733]). At the time of 
writing, the Diameter end-to-end security problem has not been 
solved, so MITM attacks by Diameter peers along the path are 
possible. Diameter-related security considerations are discussed in 
Section 13 of [RFC6733]. 
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Given that the AVPs defined in this document reveal privacy-related 
information (e.g., subscriber addresses) that can be used for 
tracking proposes, all these AVPs are considered to be security 


sensitive. Therefore, the considerations discussed in Section 13.3 
of [RFC6733] MUST be followed for Diameter messages containing these 
AVPs. 
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